Hot Topics:

Boulder Community Health investigating stolen patient records for 3rd time since 2008

At least 9 victims' records mailed to them by anonymous whistleblower

By Alex Burness, Camera Staff Writer

Posted:
05/07/2014 10:09:04 PM MDT

Updated:
05/08/2014 11:29:31 AM MDT

Lab assistant Meagan Fraley talks on the phone while working with fluid samples on , Jan. 9 in the new laboratory at Boulder Community Health's Foothills Hospital.
(Jeremy Papasso / Daily Camera)

For more information

Boulder Community Health patients who suspect their medical records may have been stolen are asked to contact the hospital's legal office at 303-440-2342.

At least nine Boulder Community Health patients have had copies of their personal medical records stolen either from inside or nearby the hospital's Foothills campus, then mailed to them by an anonymous source.

It's the third such breach the hospital has investigated since 2008.

In addition to their own patient information, at least two of the victims received a letter stating that the regional health provider — known as Boulder Community Hospital until an April 22 name change — is "still leaving medical records exposed" at many of its 18 locations in Boulder and Broomfield counties.

"The records that have been returned to you are to demonstrate the easy access that the hospital and their partners provide for someone with bad motives," the letter reads.

Later in the letter, the author accuses BCH administrators of being focused only "on building a multimillion dollar facility, soliciting donations, and selling construction bonds," while patient privacy has been "moved to the wayside."

Hospital spokesman Rich Sheehan said the hospital first learned of the breach Monday evening, and as of Wednesday knew only that the letters include records from clinic sites on the main Foothills campus and the Riverbend Office Park adjacent to it.

Advertisement

According to a statement released Wednesday, BCH will work with the Boulder Police Department and an outside investigator to conduct a full inquiry.

"Our immediate goal is to determine the scope of this situation," the statement reads.

"We will work with any affected clinics to assess the impact on their patients and provide support to affected individuals."

Though only nine victims have been identified, there may be many more. The first names, last name initials, and birth months and years of 334 people are printed on the other side of the letter.

Anonymous letter (Courtesy)

Under that list is the address and contact information of Denver's Office of Civil Rights, which handles regional Health Insurance Portability and Accountability Act (HIPAA) complaints.

Among the nine confirmed victims is Boulder Police Sgt. David Spraggs, who had a form including his name, birth date, social security number, insurance and emergency contact compromised.

His own records, which are protected by HIPAA, arrived in the mail on Monday, in an envelope postmarked from North Platte, Neb.

The envelope contained the anonymous letter, plus the patient information form he filled out at an April 9 appointment.

"It's very, very concerning for me," he said Wednesday. "We deal with identity theft in the community all the time, and so to be on this side of it, I'm very upset."

Boulder police representatives would not officially comment Wednesday on the thefts, but Spraggs said the department's response will depend on when the letters were sent and in which jurisdictions the recipients live.

Sheehan did not confirm how the records were obtained, and neither does the letter. Its author, however, suggests that patient information can be easily stolen from the bins outside of BCH's Foothills campus.

"If you travel north of Arapahoe (Avenue) on 48th (Street)," the letter reads, "you will see the blue containers that contain medical records. These containers are often left unlocked."

The letter is watermarked with pictures of trash bins and Dumpsters, which were also linked to a 2010 breach of 79 BCH patients' records.

During an internal investigation into that incident, hospital staff members found that two recycling bins outside the Community Medical Center in Lafayette were unlocked.

In 2008, BCH notified police of missing paperwork for up to 178 of the 207 patients who visited the hospital's occupational health and therapy service department between April and June of that year.

Sheehan would not comment Wednesday on what, if anything, the hospital has done to combat records breaches since the previous incidents.

Following the 2010 incident, however, the hospital said it had re-educated employees on security protocol and replaced all padlocked recycling bins with ones that automatically lock.

At the time, Sheehan said BCH would also consider shredding documents. He wouldn't comment Wednesday on its current shredding policy.

Article Comments

We reserve the right to remove any comment that violates our ground rules, is spammy, NSFW, defamatory, rude, reckless to the community, etc.

We expect everyone to be respectful of other commenters. It's fine to have differences of opinion, but there's no need to act like a jerk.

Use your own words (don't copy and paste from elsewhere), be honest and don't pretend to be someone (or something) you're not.

Our commenting section is self-policing, so if you see a comment that violates our ground rules, flag it (mouse over to the far right of the commenter's name until you see the flag symbol and click that), then we'll review it.

Boulder is pretty good at producing rock bands, and by "rock," we mean the in-your-face, guitar-heavy, leather-clad variety — you know, the good kind. For a prime example, look no farther than BANDITS. Full Story